How to Bind an HTTPS Certificate to an IIS Website
Applies to: Windows Server 2019, 2022 and 2025.
An HTTPS binding associates hostname, port and certificate. The certificate must contain the site name, include its private key and chain to a trusted issuer.
Web-server changes can expose data or interrupt production traffic. Use backups, least privilege and a staged validation path. Visit networkmanager.info for managed Windows VPS services.
Prerequisites
- Import the approved certificate into Local Computer Personal store.
- Protect PFX password and private key.
- Choose SNI when multiple HTTPS sites share one address.
- Back up IIS configuration.
Procedure
Step 1: Find certificate
Select by subject and expiry, not a guessed thumbprint.
Get-ChildItem Cert:\LocalMachine\My | Select Subject,Thumbprint,NotAfter,HasPrivateKeyStep 2: Create HTTPS binding
Add port 443 and hostname with SNI.
New-WebBinding -Name 'Portal' -Protocol https -Port 443 -HostHeader 'portal.corp.example' -SslFlags 1Step 3: Attach certificate
Replace thumbprint with the selected certificate.
$thumb='REPLACE_WITH_CERTIFICATE_THUMBPRINT'
New-Item -Path 'IIS:\SslBindings\0.0.0.0!443!portal.corp.example' -Thumbprint $thumb -SSLFlags 1Step 4: Allow firewall path
Open HTTPS only through approved edge rules.
Step 5: Test chain and hostname
Connect from a representative client.
Verification
Inspect binding and make an HTTPS request.
Get-WebBinding -Name Portal -Protocol https
Invoke-WebRequest https://portal.corp.example -UseBasicParsingRollback
Remove the HTTPS binding or restore the previous certificate binding from the IIS backup. Revoke only certificates that should no longer be trusted.
Security notes
Never paste a private key or PFX password into scripts or documentation.
Official references
Explore Netcloud24 Canada.
